Oracle PeopleSoft Enterprise PeopleTools Multiple

by Carol~ Moderator - 1/16/13 11:50 AM

In Reply to: VULNERABILITIES / FIXES - January 16, 2013 by Carol~ Moderator

Oracle PeopleSoft Enterprise PeopleTools Multiple Vulnerabilities

Release Date : 2013-01-16

Criticality level : Less critical
Impact: Manipulation of data
Exposure of sensitive information
Where: From local network
Solution Status : Vendor Patch

Software: Oracle PeopleSoft PeopleTools 8.x

Description:
Multiple vulnerabilities have been reported in Oracle PeopleSoft Enterprise PeopleTools, which can be exploited by malicious users to disclose certain sensitive information and manipulate certain data and by malicious people to manipulate certain data.

1) An error within the Query component can be exploited by authenticated users to read, update, insert, or delete certain PeopleSoft PeopleTools accessible data.

2) An error within the Security component can be exploited by authenticated users to read, update, insert, or delete certain PeopleSoft PeopleTools accessible data.

3) An error within the PIA Core Technology component can be exploited to update, insert, or delete certain PeopleSoft PeopleTools accessible data.

4) Another error within the PIA Core Technology component can be exploited to update, insert, or delete certain PeopleSoft PeopleTools accessible data.

5) An error within the PeopleBooks - PSOL component can be exploited to update, insert, or delete certain PeopleSoft PeopleTools accessible data.

6) An error within the PeopleCode component can be exploited authenticated users to read, update, insert, or delete certain PeopleSoft PeopleTools accessible data.

7) An error within the Portal component can be exploited to update, insert, or delete certain PeopleSoft PeopleTools accessible data.

8) Another error within the Portal component can be exploited to update, insert, or delete certain PeopleSoft PeopleTools accessible data.

9) An error within the Security component can be exploited by authenticated users to update, insert, or delete certain PeopleSoft PeopleTools accessible data.

10) An error within the RTE - Rich Text Editor component can be exploited by authenticated users to update, insert, or delete certain PeopleSoft PeopleTools accessible data.

The vulnerabilities are reported in versions 8.51 and 8.52.

Solution:
Apply patches (please see the vendor's advisory for details).

Provided and/or discovered by:
It is currently unclear who reported the vulnerabilities as the Oracle Critical Patch Update for January 2013 only provides a bundled list of credits. This section will be updated when/if the original reporter provides more information.

Original Advisory:
Oracle:
http://www.oracle.com/technetwork/topics/security/cpujan2013-1515902.html#AppendixPS

http://secunia.com/advisories/51889/